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23 MAY 1980 


MEMORANDUM FOR: Director of Logistics 


wyhieL, Procurement Management Staff, OL 


SUBJECT: Incorporation of Security Requirements 
. into Agency Contracts 


REFERENCE: © Standard Security Procedures for Contractors 
dated 1 May 1979 


1. Introduction 


The purpose of this memorandum is to request your approval 
to implement a major overhaul to our current procedures for 
incorporating security requirements into Agency contracts. 


2, Background 


a. Before we outline our proposed approach, a brief 
description of our current procedures should be noted. 
The first document contractors sign to acknowledge their 
responsibility for the Agency's special security requirements 
is the "Contractor's Secrecy and Security Agreement." A copy 
of this document is provided as Attachment A. The "Contractor's 
Secrecy and Security Agreement" is incorporated into our con- 
tracts by a clause in our General Provisions. (This is now 
accomplished in the schedule on the contract because the docu- 
ment referenced in the current General Provisions is obsolete.) 
No mention is made of the Agency's security manual in this 
agreement. In the past, the same clause in the general Provisions 
incorporated the "Security Requirements for Contractors" which 


STAT 


in the General Provisions. 

STAT ment Note issue anuary 1979 required that the appropriate 
security manual be incorporated into the contract in the contract 
schedule. Procurement Note 135 dated 29 February 1979 directed 
that all new contracts and current active contracts incorporate 
the new security manual. 
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b. The new security manual (green book and white book) 
was published with a date of 1 May 1979. Subsequently, it 
was revised by letters (with various dates) to Agency con~ 
tractors. The principal change involved. substitution of one 
of the sections and other minor changes were also made. Later, 
Appendix VI, undated, and entitled "Security Requirements for 
Automated Information Systems" was issued. It is readily 
apparent that if our new security manual is going to be a 
"living document," subject to frequent change, we are going 
to have to revise our current procedures. . 


3e Proposed Approach 


-. At the risk of our being accused of looking more and more like 
a Department of Defense (DOD) organization, we recommend adopting 
the basic approach used by DOD under its industrial security 
program. DOD enters into a security agreement with contractors 
which requires the contractors to maintain a security program 
which meets the requirements of the Department of Defense 
Industrial Security Manual for Safeguarding Classified Information 
as it exists and as it may be revised by the demands of national 
security as determined by the Government. The agreement does not 
obligate Government funds and has a caveat that the Government 
shall not be liable for any costs or claims of the contractors 
arising out of the agreement or instructions issued thereunder. 
However, the agreement does state that the parties may provide, 
in other written contracts, for security costs which may be 
properly chargeable thereto. The DOD approach obviates the need 
to amend every contract each time the DOD Industrial Security 
Manual is changed. We propose doing away with the "Contractor's 
Secrecy and Security Agreement" and adopt the approach followed by 
DOD. This means we will have to cover the main points of the 
"Contractor's Secrecy and Security Agreement" and modify the 
DOD agreement form to meet our special needs. 


4, Special Concerns 


a. The approach we are recommending is not a panacea. 
As you are aware, the indirect cost principles and accounting 
procedures with regard to security costs for our major con- 
tractors who also contract with DOD will be based on the DOD 
Industrial Security Manual. It is our view that only in the 
rarest circumstances should we agree to accept security costs 
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as.a direct charge to our contracts. We believe that a. 
position paper should be prepared which outlines the basic 
arguments that can be used to counter contractor claims 

that they are entitled to be reimbursed direct costs because 
our security requirements may be somewhat different from DOD's. 


b. A second problem is concerned with how we control 
changes to our security manual so as to avoid creating unfunded 
changes. When a unilateral change order is issued, the con- 
tracting agency must record, as an obligation, the amount of 
funds necessary to cover the Government's estimate of the cost 
of the change. As the manual is changed, a determination should 
be made that the revision will not result in a compensable charge 
to the Agency. This determination will not preclude a contractor 
from submitting a claim if one is warranted. 


c. There is also a question of whether or not contractors 
will accept the approach recommended, Their reluctance would be 
based upon our emphasis on termination for default for failure 
to maintain a security program meeting our requirements. 


d. We need to resolve who will sign the proposed security 
agreements for the Agency. Perhaps you might issue a special 
delegation to our security officers and allow them to execute 
the agreements on behalf of the Agency. a 


_ 5. Recommendation 
It is recommended that we prepare the necessary agreement 
and appropriate clauses to implement the approach mentioned in 
paragraph 3 above to incorporate security requirements into Agency 
contracts. Attached are the following documents: 


Attachment A - CIA Form 2270 - Contractor's | 
Secrecy and Security Agreement 


Attachment B - DD Form 254 - Contract Security 
Classification Specification 


Attachment C - DD Form 441 - Security 
Agreement 
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“Attachment D - DAR Clause 7-104.12 - 
rare Security Requirements 
(1971 APR) 
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APPROVED: 
4s/ James H. McDonald - 3.0 MAY 1980 
Director BE Tegistics “Pate 
Distribution: | 


OL files 
D/L chrono 


"tD: OL/PMS official 
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